[PATCH 14/16] carl9170: main: guard op_config and bss_info_changed against non-STARTED state

[Masi Osmani <mas-i@hotmail.de>]

During driver deregistration (USB unbind or restart), mac80211 calls
carl9170_op_config() and carl9170_op_bss_info_changed() which write
hardware registers such as AR9170_MAC_REG_SLOT_TIME (0x1c36f0) via
carl9170_set_slot_time().  At this point the firmware is already dead:
carl9170_restart() has transitioned the state machine from STARTED to
IDLE, and IS_ACCEPTING_CMD() returns true for IDLE (state >= IDLE),
so the USB command is attempted but times out with -EIO:

  ieee80211 phy31: writing reg 0x1c36f0 (val 0x2400) failed (-5)
  ieee80211 phy31: writing reg 0x1c36f0 (val 0x5000) failed (-5)

When wavemon or NetworkManager trigger rapid USB unbind/rebind
recovery cycles, each deregistration produces these -EIO errors.
Over 30+ cycles this exhausts mac80211 resources and causes a
kernel panic.

Add early returns if !IS_STARTED(ar) to both carl9170_op_config()
and carl9170_op_bss_info_changed() to prevent all hardware register
writes when the device is not fully operational.

Signed-off-by: Masi Osmani <mas-i@hotmail.de>
---
 drivers/net/wireless/ath/carl9170/main.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index dcedcb1..a1b2c3d 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -926,6 +926,13 @@ static int carl9170_op_config(struct ieee80211_hw *hw, int radio_idx, u32 change
 	struct ar9170 *ar = hw->priv;
 	int err = 0;

+	/*
+	 * All register writes below require running firmware.
+	 * Bail out early during teardown or restart (state != STARTED).
+	 */
+	if (!IS_STARTED(ar))
+		return 0;
+
 	mutex_lock(&ar->mutex);
 	if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
 		/* TODO */
@@ -1077,6 +1084,13 @@ static void carl9170_op_bss_info_changed(struct ieee80211_hw *hw,
 	struct carl9170_vif_info *vif_priv;
 	struct ieee80211_vif *main_vif;

+	/*
+	 * All register writes below require running firmware.
+	 * Bail out early during teardown or restart (state != STARTED).
+	 */
+	if (!IS_STARTED(ar))
+		return;
+
 	mutex_lock(&ar->mutex);
 	vif_priv = (void *) vif->drv_priv;
 	main_vif = carl9170_get_main_vif(ar);
--
2.51.0